Upgrading from FreeBSD 4.x-RELEASE to 4.x-STABLE INTRODUCTION/DISCLAIMER ----------------------- I am, by no means, the foremost authority on FreeBSD upgrading or kernel tuning. However, this document should serve as a useful guide that reflects the methods that I've used in the past to successfully upgrade my systems to the STABLE FreeBSD branch. I can't stress enough that this is an unofficial document which is strongly influenced by my own style and experience, so please surf around before taking my word for it. I'm also going to point out some other (mis)information that may be of use to those of you who are configuring FreeBSD for use as a dedicated IRC server. If you're looking for finite examples of tuning a FreeBSD box, you're in the wrong place. This document may be modified, reproduced, and distributed free of charge, as long as the "INTRODUCTION/DISCLAIMER" notice and the original author's name are both included. Also, please go to http://www.freebsd.org/copyright/index.html for FreeBSD copyright information. The methods documented here were tested by yours truely by upgrading to FreeBSD 4.4-STABLE from 4.3-RELEASE and 4.4-RELEASE. Updated 29-Sep-2001 - David Friedman (driz@irctoo.net) for IRCtoo (www.irctoo.net) Created 21-Jan-2001 - David Friedman LET'S BEGIN ----------- We'll start out by updating to the latest sources below. 1) Modify /usr/share/examples/cvsup/stable-supfile to your liking. You'll at least need to change the "host=CHANGE_THIS.FreeBSD.org" to something like "host=cvsup.freebsd.org". I use UUnet's FreeBSD mirror, cvsup11.freebsd.org, because we have transit via UUnet at work. Make note of the following 2 lines in the example stable-supfile: # If your network link is a T1 or faster, comment out the following line. *default compress You should make use of ompression if the speed of your internet connection demands it. It can certainly save time. 2) cvsup -g -L 2 stable-supfile After this command completes successfully, you've got the latest STABLE sources. Now you're ready to move on to rebuilding everything. 3) cd /usr/src 4) make buildworld The buildworld may take a very long time. The fastest buildworld that I've ever witnessed was somewhere between 60 and 90 minutes on a 1.4GHz ThunderBird. You may choose to go have a few pots of coffee while you wait, but I suggest using this time wisely by configuring your kernel. 5) cd /usr/src/sys/i386/conf 6) cp GENERIC MYKERNEL I generally use the hostname of my machine for my kernel configuration name, but MYKERNEL will suffice for this document. 7) pico MYKERNEL Now that you're in pico, the world's most intuitive editor, let's take some time to point out some kernel options worth mentioning. I'll focus on a very vanilla IRC server setup with little hardware support. It's a good idea to remove unnecessary components. If, for example, you have a ThunderBird 1GHz with only an IDE controller and an Intel EtherExpress NIC, you should remove all scsi-related kernel options, and remove all network interface card drivers aside from the fxp0 driver. Keep in mind that many NIC drivers require the miibus device. Don't lock yourself out! Make sure you remove things like IPv6 support, math emulation, NFS support, CD-ROM support, and only define the CPU that you have. For example, if you have a ThunderBird, you'd use "cpu I686_CPU", and comment the others out. You always need to leave the "machine i386" part. You should also remove USB support. Here are some other options worth looking at (some comments were taken from /usr/src/sys/i386/conf/LINT): # # TCP_DROP_SYNFIN adds support for ignoring TCP packets with SYN+FIN. This # prevents nmap et al. from identifying the TCP/IP stack, but breaks support # for RFC1644 extensions and is not recommended for web servers. # options TCP_DROP_SYNFIN #drop TCP packets with SYN+FIN # ICMP_BANDLIM enables icmp error response bandwidth limiting. You # typically want this option as it will help protect the machine from # D.O.S. packet attacks. # options ICMP_BANDLIM NMBCLUSTERS are a bit deceiving. More is not necessarily better. You shouldn't need to increase this setting above 16,000 on a very large IRC server. options NMBCLUSTERS=16000 If you're using an AMD, I recommend the following options: options "NO_F00F_HACK" options CPU_WT_ALLOC options NO_MEMORY_HOLE A whole slew of options that can be added or removed based on your hardware can be viewed in /usr/src/sys/i386/conf/LINT. Assuming you don't have means to filter upstream, you may also want to look at the bpf, IPFIREWALL, or IPFILTER options. In fact, I recommend enabling bpf by default for administrative and network diagnostic purposes. If you do enable IPFIREWALL, I highly suggest that you accompany it by the IPFIREWALL_DEFAULT_TO_ACCEPT option to prevent locking yourself out of the box. Okay, so you've read my rants, and your buildworld is done. Let's move on to building the kernel. If you've left /usr/src, please go back to that now. For help using the "cd" command, see "man cd". 8) make buildkernel KERNCONF=MYKERNEL && make installkernel KERNCONF=MYKERNEL 9) if you enabled IPFIREWALL, you should probably temporarily add the following to /etc/rc.conf: firewall_enable="YES" firewall_type="open" It's good that we've set the firewall type, if enabled, to "open". This way we can remove ip filtering from the troubleshooting equation in the (un)likely event that the box doesn't come back up. 10) reboot ..a few moments of anticipation. ..a few moments of sweating. ..a moment of fear. ..a moment of denial. ..a few moments of ..presto! It came back up, but then you knew it was going to all along, didn't you? Now it's time to install all of those new binaries that you waited so long to compile. 11) make installworld Mergemaster will compare your configuration files to the new STABLE ones that you downloaded with cvsup. This is a very helpful script, but it can also be your undoing, so I suggest you are very careful not to overwrite any of your custom files with new default ones. Some potential hazards include /etc/group, /etc/rc.conf, etc. For more information, see "man mergemaster". 12) mergemaster If a new MAKEDEV is installed, mergemaster will ask you if you want to run "cd /dev && /bin/sh MAKEDEV all". You can go ahead and say "yes", or feel free to do it yourself afterwards. Let's clean up our mess. 13) make clean 14) reboot ..a few moments of anticipation. ..a few moments of sweating. ..a moment of fear. ..a moment of denial. ..a few moments of ..presto! It came back up, but then you knew it was going to all along, didn't you? Congratulations! If your system came back up, you're in business. Most of you can stop here, but I've continued on to cover some other points of interest. If you enabled IPFIREWALL, you may choose to modify /etc/rc.conf to reflect firewall_type="client" instead of firewall_type="open", and edit /etc/rc.firewall accordingly. I'm not going to delve into that, though. If you want to hold a lot of IRC users, you may need to increase your fd's, or file descriptors: sysctl -w kern.maxfiles=32768 sysctl -w kern.maxfilesperproc=32768 As you can see above, file descriptors can be updated on the fly, but they DO reset upon reboot, so be sure to put the above commands into /etc/sysctl.conf or /etc/rc.local. FreeBSD, by default, give users unlimited resources. This is probably not the best idea. For this reason, I recommend setting up a special "ircd" class in /etc/login.conf. It's important that you leave most things unlimited, but I recommend limiting RAM to slightly less than the amount of RAM that your server has. On a machine with 128MB RAM, I'd limit memory use to 120MB, etc. It's your choice. Once you're done, you'll need to run the following command: cap_mkdb /etc/login.conf Then, simply chfn , and change the login class to "ircd". A few more things should be modified. I recommend adding the following to /etc/rc.conf: portmap_enable="NO" sendmail_enable="NO" xntpd_enable="YES" xntpd_program="ntpd" usbd_enable="NO" The above assumes that you don't need portmap, usbd, or sendmail. What's that, you're going to run an IRC server on a mail server? Lovely. You'll need to make an /etc/ntpd.conf file. Here's an example: server 192.168.0.1 prefer server 192.168.4.2 driftfile /etc/ntp.drift Replace the private IP's above with an ntpdate server near you. Check out http://www.gpsclock.com/ for a lot of nifty information about that. For those of you who don't have much RAM to spare, you can edit /etc/ttys, comment out ttyv1 through ttyv8, and then run the command "init q". This will save you a few megabytes. hey driz you wacky goose in your the freebsd.txt all of the slashes are backward, and there is no drive name to prexif any of the direcotries!